hazard audit guidelines - planning.nsw.gov.au

34
Hazardous Industry Planning Advisory Paper No 5 Hazard Audit Guidelines January 2011

Upload: others

Post on 08-Jan-2022

4 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Hazard Audit Guidelines - planning.nsw.gov.au

Hazardous Industry Planning Advisory Paper No 5

Hazard Audit Guidelines

January 2011

Page 2: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines © State of New South Wales through the Department of Planning 2011 23–33 Bridge Street Sydney NSW Australia 2000 www.planning.nsw.gov.au ISBN 978-0-73475-864-4 DOP HAZ_008 Disclaimer: While every reasonable effort has been made to ensure that this document is correct at the time of printing, the State of New South Wales, its agents and employees, disclaim any and all liability to any person in respect of anything or the consequences of anything done or omitted to be done in reliance upon the whole or any part of this document.

Page 3: Hazard Audit Guidelines - planning.nsw.gov.au

Foreword

Since the 1980s, the New South Wales Department of Planning has promoted and implemented an integrated approach to the assessment and control of potentially hazardous development. The approach has been designed to ensure that safety issues are thoroughly assessed during the planning and design phases of a facility and that controls are put in place to give assurance that it can be operated safely throughout its life.

Over the years, a number of Hazardous Industry Advisory Papers and other guidelines have been issued by the Department to assist stakeholders in implementing this integrated assessment process. With the passing of time there have been a number of developments in risk assessment and management techniques, land use safety planning and industrial best practice.

In recognition of these changes, new guidelines have been introduced and all of the earlier guidelines have been updated and reissued in a common format.

I am pleased to be associated with the publication of this new series of Hazardous Industry Advisory Papers and associated guidelines. I am confident that the guidelines will be of value to developers, consultants, decision-makers and the community and that they will contribute to the protection of the people of New South Wales and their environment.

Director General

Page 4: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

iv | Department of Planning

Contents

Executive Summary v 1 Objectives and Principles 1 1.1 Objectives of hazard audits 1 1.2 Principles of hazard audits 1 2 Audit Methodology 4 2.1 Overview of the audit method 4 2.2 Familiarisation with the site location and layout 5 2.3 Plant operations 7 2.4 Management Systems 10 2.5 Site History 12 3 Report Format and Content 14 3.1 General 14 3.2 Introduction and Scope of Report 14 3.3 Overview of the site 15 3.4 Hazard audit of plant operations 16 3.5 Hazard audit of management systems 17 3.6 Site History 17 3.7 Conclusions 18 3.8 Appendices 18 3.9 Glossary of abbreviations 18 Appendix 1 19 Materials Transfer and Process Equipment 19 Appendix 2 20 Loading and Unloading Operations 20 Appendix 3 21 Storage Systems 21 Appendix 4 23 Computer Controls in Process Plants 23 Appendix 5 24 List of Documented Information that may be Reviewed for Audit 24

List of Figures

Figure 1: The Hazards-Related Assessment Process vi

Page 5: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

v | Department of Planning

Executive Summary

Background

The orderly development of industry and the protection of community safety necessitate the assessment of hazards and risks. The Department of Planning has formulated and implemented risk assessment and land use safety planning processes that account for both the technical and the broader locational safety aspects of potentially hazardous industry. These processes are implemented as part of the environmental impact assessment procedures under the Environmental Planning and Assessment Act 1979.

The Department has developed an integrated assessment process for safety assurance of development proposals, which are potentially hazardous. The integrated hazards-related assessment process comprises:

a preliminary hazard analysis undertaken to support the development application by demonstrating that risk levels do not preclude approval;

a hazard and operability study, fire safety study, emergency plan and an updated hazard analysis undertaken during the design phase of the project;

a construction safety study carried out to ensure facility safety during construction and commissioning, particularly when there is interaction with existing operations;

implementation of a safety management system to give safety assurance during ongoing operation; and

regular independent hazard audits to verify the integrity of the safety systems and that the facility is being operated in accordance with its hazards-related conditions of consent.

The process is shown diagrammatically in Figure 1.

A number of Hazardous Industry Advisory Papers (HIPAPS) and other guidelines have been published by the Department to assist stakeholders in implementing the process. All existing HIPAPs have been updated or completely rewritten and three new titles (HIPAPs 10 to12) have been added.

A full list of HIPAPs is found at the back of this document.

The part of the process covered by this guideline is highlighted in Figure 1.

Page 6: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

vi | Department of Planning

Figure 1: The Hazards-Related Assessment Process

PreliminaryHazard Analysis

ConstructionSafety Study

Safety Management System

Design Stage

Hazard andOperability

Study

FinalHazard

Analysis

FireSafetyStudy

Pre-

app

roval

OperationalStage

Construction/Commissioning

Stage

Independent Hazard Audits

Po

st-app

roval

Development Application

Stage

Emergency Plan

The Hazard Audit A hazard audit is a systematic and critical examination of a facility, its operations and safety systems. Its object is to identify any shortcomings in the measures which are in place to minimise the likelihood and consequences of hazardous incidents.

The requirement for regular hazard audits recognises that with the increasing scale of operation, complexity of technology and automation of industry, continued commitment is required for the safe operation of potentially hazardous facilities. Independent hazard audits provide assurance that the plant and operations, as a whole, continue to be safe and to be operated at a high level of competence. They provide an opportunity to review plant, equipment, operating procedures and safety systems and to incorporate, where appropriate, further improvements to hardware and software systems. Operating standards are therefore not only maintained but are continually reviewed and updated to incorporate new technology or information.

For development approved under the 'seven stage' approval process hazard audits are usually required one year after operations commence, and at periodic intervals thereafter. Audits are equally applicable to existing developments where they may trigger other studies such as a hazard analysis or a hazard and operability study (if these have not previously been carried out). A hazard audit may also identify the need for revision of previous studies.

On occasion, the audit may recommend that part or the whole of the facility be closed until urgent matters are remedied.

This paper provides guidance on the requirements and general approach to be adopted for hazard audits and the form and content of the audit report. It is not intended to

This Guideline

Page 7: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

vii | Department of Planning

provide the basis for a group without prior knowledge or experience to carry out a hazard audit.

A short list of reference material for further reading is included at the end of this document. It must be stressed, however, that reading cannot by itself provide the necessary training and experience required of an auditor.

The paper is divided into three sections. Some general principles are outlined in section 1. Section 2 outlines the methodology for a hazard audit and section 3 details the suggested form and content of the hazard audit report.

Page 8: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

1 | Department of Planning

1 Objectives and Principles

SECTION SUMMARY

Hazard audits are intended to verify that a facility’s technical and management systems are adequate for the ongoing control of operational hazards and risks. A hazard audit recognises that, with the passing of time, there can be changes in the hazards that need to be managed, changes in standards and changes in a facility’s skills and safety awareness.

The hazard audit provides an independent and holistic evaluation of the various systems, identifies shortcomings and makes recommendations for ongoing improvement.

This section lays out broad principles for effective audits.

KEY MESSAGE

An effective audit should lead to continuous improvement.

1.1 Objectives of hazard audits The main objective of a hazard audit is to evaluate the nature and scale of hazards and the systems — both hardware and software — that are used to control these hazards.

The expected outcome of the audit is recommendations for hazard and risk reduction measures for specific plants and equipment, for larger process areas and for operating and other procedures and practices, preferably ranked in order of priority.

The desired end result is the identification of previously unrecognised hazards, appraisal of the magnitude, likelihood and consequences of potentially hazardous incidents in the light of experience, and early recognition of sub-optimal performance in areas such as management controls and the maintenance and testing of critical equipment.

Where previous studies and audits have been undertaken, a main focus of the hazard audit is on changes that have occurred since the completion of those studies. At the same time, the adequacy of the design and operating practices and procedures etc. should be kept under review.

The method used for the audit depends on the specific nature of the site, the type of operations carried out and the scale of the development. The level of detail at which the audit is carried out depends on the specific objective of the particular audit. Hazard audits may be carried out for a number of reasons and the particular emphasis and objectives of an audit may vary accordingly. For example, an audit may be triggered by a particular incident or by the requirements of a regulatory agency. It may also be appropriate to focus particular attention on some aspect (such as a particular plant or system).

The audit requires site visits and a review of documentation systems established at the facility. These should indicate the extent to which systems and procedures exist to operate and maintain the plant for the purpose for which it was designed. In particular, monitoring records of the plant's critical parameters provides an operational history of the plant and the degree and frequency with which operating conditions vary from design conditions

1.2 Principles of hazard audits There are a number of basic principles that determine whether a hazard audit will be effective. Of paramount importance is that the hazard audit should be systematic and comprehensive, covering the entire site so that interactions between various parts of

Page 9: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

2 | Department of Planning

the facility are taken into account. It must be performed by an independent party which brings a fresh and unbiased approach to evaluating all aspects of the facility.

The essential principles of a hazard audit are:

(i) that it be systematic and comprehensive

It should normally be a comprehensive review of the entire facility and should not be restricted to a particular part of the facility. On a large facility, the audit may be confined to a specific process or area. However, in this case it is essential that interactions with the rest of the plant are included,

The complexity of modern plants makes it difficult, if not impossible, to see what might go wrong unless the process at the site is followed systematically. This approach also ensures that interactions between various processes and operations are taken into consideration when evaluating hazards.

(ii) that it be independent

Hazard audits are most effective and reliable when undertaken by an independent third party or an independent small team with a nominated team leader. It is important that the auditor(s) are independent of plant management so that they are not inhibited from disclosing strengths and weaknesses and can recommend necessary actions. This does not preclude use of auditors from within the same company provided that they are clearly at 'arms length' from the facility.

(iii) that it be site specific

Hazard audits should be site specific. The approach and methodology used should therefore depend on the nature and scale of the development. The auditor may use a variety of methods to evaluate different aspects of the facility's operations. The various elements of the audit may be performed at different levels of detail, depending on the audit's objective. The specific approach is properly left to the discretion and judgement of the auditor or audit team leader.

(iv) that it depends on the auditor's skills

The audit is only as good as the skills and judgment of the auditor in challenging the design of the physical plant and questioning the validity of operating procedures. The auditor's skills and experience must be appropriate to the facility. This requirement should not prevent auditors crossing industry boundaries, but the capacity to audit one type of facility should not automatically be taken as a capacity to audit any type of facility.

While specific equipment or process units may comply with applicable codes and standards, hazardous incidents are still possible and the auditor must be able to discover any shortcomings (due to interactions between equipment, processes and materials) that could result in a hazardous situation. To do this successfully, the auditor must be able to understand the plant and processes at the facility and to make independent observations without preconceptions.

The appropriate size for the audit team depends on the audit's objective, the level of detail to be considered, and the scale and complexity of the plant.

(v) that it reviews documentation systems

The audit should determine the extent to which appropriate systems have been established to maintain up-to-date plant documentation, monitoring records of the plant's critical parameters, testing and maintenance records of critical equipment and instruments and a history of any hazardous incidents or near incidents that have occurred.

System documentation provides feedback on the performance of hardware and software systems. The audit should particularly check that plant management is acting on the performance information in the system's documentation.

Page 10: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

3 | Department of Planning

(vi) that it focuses on changes that have occurred

The hazard audit should focus on changes that have occurred since the facility was commissioned or since the last audit. The safety of plants can be compromised as a result of changes to plant equipment or procedures. Where there have been significant modifications, the hazard audit should review the effects of these on the entire site.

To avoid preconceptions it may be appropriate not to review previous audit documents until after the initial site visit.

(vii) that it presents opportunity for further improvements

Ideally, the audit should result in improvements beyond the level at which the facility may have originally been designed and approved.

It presents an opportunity to incorporate the latest technology and information in both hardware and software systems so that plant management can reduce risks to a level which is as low as is reasonably achievable,

(viii) that its results are accepted and implemented by management

Plant management should have confidence in the abilities of the auditor. This will facilitate acceptance of the findings of the audit. The audit process should include a post audit debrief so that management understands the rationale underlying recommendations arising from the audit. Recommendations from the audit, and outstanding recommendations from previous studies, should be listed with an indication of priorities so that essential items are completed as soon as possible. The report should include an implementation schedule that has been developed co-operatively with management.

(ix) that it is approved by the appropriate authority

Where the result of the hazard audit has to be submitted to an approving authority, prior consultation regarding the suitability of the auditor is typically required. The report should demonstrate to the approving authority and to future management the suitability of the audit team and the quality of the audit.

Page 11: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

4 | Department of Planning

2 Audit Methodology

SECTION SUMMARY

This section outlines the methodology of a hazard audit. The form and content of the report are described in section 3.

Unlike some audits, which are designed to verify that established systems and procedures are being followed, a hazard audit requires an investigative approach, which also considers whether or not the systems and procedures themselves are adequate.

An audit may be carried out by a team or an individual, depending on the scope of the work.

The components of the auditor’s task include:

general familiarisation with the site location, layout, processes and hazards;

review of the adequacy of systems and procedures for such aspects as materials handling and storage, process control, fire safety, environmental protection and security;

a review of the integrity of the site safety management systems and associated documentation; and

consideration of site history, including incidents and the implementation status of recommendations from previous studies.

The audit should highlight any deficiencies found and make recommendations for necessary improvements.

KEY MESSAGE

The skill of the audit team is as important as the audit methodology used.

2.1 Overview of the audit method The effectiveness of the audit relies on the skills and judgment of the auditor to evaluate the physical plant, operating practices and procedures as well as the facility’s safety systems. This is not only to ensure compliance with applicable codes and standards but to discover any shortcomings that could result in a hazardous situation. When appointing an auditor or audit team, the relevance of their skills and experience should be carefully considered. Any form of generalised industry or government accreditation should not be solely relied on.

Generally, checklists or scoring schemes are not recommended. They are inflexible and do facilitate evaluation. They do not question the validity of existing systems and tend to ignore interactions between various parts of the facility. They are least satisfactory when the design is new and many hazards have not been encountered before. Specifically designed checklists may be appropriate only in special circumstances, i.e. for small-scale facilities or for self-contained process units that have no interaction with the rest of the facility.

In general, a more investigative approach is required. The specific method used to audit the site is left to the discretion of the auditor or audit team leader. The auditor may carry out the audit in different ways to evaluate different aspects of the facility's operations. The various elements of the audit may be performed at different levels of detail, depending on the reason for the audit, the nature of hazards at the facility and the scale of the development.

In order to facilitate the critical evaluation of plant, equipment and procedures, the audit team should familiarise itself with the location and layout of the facility, the operations carried out and the properties of materials being processed and stored on site. Consideration of existing hazard analysis reports and audit reports will also facilitate the audit process.

Page 12: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

5 | Department of Planning

This may require several site visits, possibly including an unannounced visit, preferably at varying times, to observe critical operations such as start-up, shutdown, loading and unloading. In order to have a full appreciation of operations at the facility, the site visits may be preceded by a questionnaire.

The auditor(s) should have the freedom to ask questions at every level - operators, supervisors and managers - in order to discover inconsistencies which plant personnel may have missed in routine operations. The emphasis should be on personal and independent testing and verification of facts by the audit team.

For new developments, a good reference point for the first hazard audit is the studies prepared as part of the development consent process. These include hazard and operability studies and hazard analyses, fire safety studies and emergency plans and procedures. The audit should determine if the plant is operating as approved and if operating conditions differ from design conditions. The audit should also ensure that all recommendation made in these studies have been implemented

Monitoring records for the operation's critical safety parameters, inspection, testing and maintenance records, and analyses of hazardous incidents, accidents and near misses should be evaluated. These provide an operating history of the plant and may indicate inconsistencies.

It is essential that the audit covers an assessment of maintenance programs and procedures, safeguards and hazard control systems, fire safety and emergency planning and an evaluation of the quality of documentation covering these programs and procedures. The auditor should determine whether operating procedures and practices are kept up to date. Systems for staff selection and training should also be reviewed.

When auditing procedures, it may be useful to take a "vertical slice" through the organisation in order to cover what the manager says should happen; how the supervisor organises the job; and what the operators actually do.

Such discussions may provide opportunities to introduce further improvements to both hardware and software systems.

The results of the audit should be discussed in a debriefing session with plant management. The outcome of these discussions should be a schedule for the implementation of recommendations arising from the audit.

The use of photographs and videos may be useful as an aide memoire and in the debriefing of plant management. Auditors must, however, be sure to observe the safety procedures and wishes of site management and must exercise care to ensure they in no way contribute to potentially hazardous situations,

2.2 Familiarisation with the site location and layout The existence and nature of other facilities in the vicinity and the site location in relation to surrounding land uses should be considered to determine areas external to the site which may be vulnerable to incidents at the facility. If located in an area with a concentration of hazardous industry, the facility may be exposed to the effects of emergencies at neighbouring sites. The overall terrain and natural features of the site may also expose it to natural hazards such as flooding, windstorm and earthquakes.

A site history, which includes when the plant was built and details of modifications carried out (including why and when these were carried out), will provide background information on design and construction standards for the plant and whether the plant is operating as originally approved.

The plant layout should be reviewed, preferably before the site visit, to understand the placement of process and storage areas and to note potential hazards. Hazardous units should be separated from critical areas such as control rooms. The overall layout and spacing of individual storage and process units should be sufficient to protect them from exposure to damage, interference or excessive heat and to limit the spread of fire

4

Page 13: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

6 | Department of Planning

and explosions, Hazardous process units and storage areas should be located a safe distance away from the boundary of the site in order to limit off-site effects in an emergency.

The adequacy of access and egress points to the site and roadways available for evacuation in an emergency should be assessed.

Buildings, plant and equipment should be constructed to limit the spread of fire and explosions and to withstand the incidence of natural disasters. The age and condition of structures and evidence of deterioration, such as corrosion and leaks, should be noted as failure can lead to hazardous situations.

The reliability of electricity, water supply and other site utilities should be appraised along with general tidiness on the site.

Storage and process areas should be clearly identified, and there should be no obstructions in access ways.

The auditor should evaluate whether the site is left unoccupied at any time and the type of security measures that are appropriate during and outside normal working hours. The adequacy and condition of perimeter security should also be assessed,

2.2.1 Process description In order to be effective, the audit team must have a full understanding of the plant and the processes being carried out. A full description of the process, preferably in documented form, along with detailed process flow diagrams, should be sought from plant management.

This information will help the auditor to identify the various process steps in sequential order and the hazards inherent in these.

Other important information includes:

whether the process is batch or continuous;

the production rates, processes and reactions involved and the physical conditions for these;

whether there is cooling or heating during the processes, and

whether catalysts are used in the chemical reactions.

The behaviour of chemical reactions and the possibility of unintended reactions that could occur at different temperatures and pressures should be considered.

2.2.2 Properties of materials being handled/processed It is essential that complete information on all materials and chemicals being stored and processed on site, including intermediate and waste products, is available. This information will assist in the assessment of potential hazards at the facility. It is important to identify those chemicals which may be biologically harmful to humans, a danger to the environment or capable of causing serious damage to property, and the degree of hazard they present.

Generally, the emphasis should be on toxic, flammable, potentially explosive, corrosive, radioactive or oxidizing materials. In some cases, human or animal disease organisms and materials which may have an adverse impact on the biophysical environment through excess nutrient loads or fouling etc. may be relevant.

The physical and chemical properties which are important include:

chemical name or constituents (where proprietary or trade names are used);

physical state;

density;

vapour pressure;

Page 14: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

7 | Department of Planning

water solubility;

normal boiling point;

melting point;

flash point;

flammable limits;

reactivity with water and air;

gases released during decomposition (including combustion);

incompatibility with other chemicals or materials, corrosiveness; and

toxicity.

2.3 Plant operations A general description of all activities on site, including process equipment, storage vessels, materials transfer equipment and the quantities of hazardous materials stored, processed and transferred, should be sought. Actual operating conditions should be compared to design conditions to evaluate the suitability of materials of construction, vessel size, other design parameters and spacing.

In evaluating equipment for transferring materials and drainage and containment systems, the ways in which hazardous materials might escape from containment and precautions taken to limit the potential consequences should be considered.

An assessment of support structures, critical components, controls and process instrumentation should be made to ensure they are in good condition and inspected, tested and maintained regularly. The audit team should evaluate systems for ensuring the integrity of all pressure vessels and relief systems on site.

The condition of ancillary equipment such as pumps and associated equipment and instrumentation and records of their inspection, calibration, maintenance and testing should be assessed.

Appendix 1 outlines some relevant features of materials-transfer and process plant that should be evaluated.

An evaluation of emergency and fire protection systems should be made to ensure they are appropriate to the type of materials being processed and stored and are in good working order. Similarly, the adequacy of fire prevention systems and emergency planning should be reviewed.

An assessment of the adequacy of the number of operators and contractors employed on site and their training should be made.

Where previously carried out, hazard and operability studies and hazard analyses may be used as a reference against which operations are evaluated. The auditor should determine what changes have occurred, whether the plant is operating as approved and whether recommendations previously made have been implemented.

Recommendations for improvement in process and storage areas may cover specific items of equipment as well as larger areas or groups of units.

2.3.1 Loading and unloading To facilitate the evaluation of loading and unloading operations, full information on these operations should be sought, including:

what materials and quantities are being transported to and from the site;

whether there is a seasonal variation (the maximum and average quantities or volumes);

the mode of transport;

Page 15: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

8 | Department of Planning

the type of containment or packaging used; and

average and peak numbers of movements per day/week/year.

Where materials are transported to/from the site by pipeline, the pipeline design, condition and testing should be reviewed.

Transport routes by various forms of transport to and from the site should be evaluated to ensure they minimise the chance of community exposure to hazardous materials. Where possible, loading/unloading operations with serious potential for hazardous incidents should be observed.

Appendix 2 outlines some relevant aspects of loading and unloading operations.

2.3.2 Storage Large amounts of hazardous chemicals and materials are a significant hazard if not handled correctly. A full description of storage systems should be available, including:

the nature of the product stored in storage vessels, drums or other containers; and

average and maximum inventories for each vessel/ storage container; and

drainage and containment systems.

Where materials are stored in warehouses in drums or other packaging, the auditor should confirm that the storage is appropriate to the design and the capability of fixed fire prevention systems.

Opportunities for reducing amounts of hazardous materials should be considered.

Some of the factors which should be evaluated for storage systems are outlined in Appendix 3

2.3.3 Process Control The auditor should comment on whether the plant will fail safe if critical equipment or services are interrupted. It is important to include conditions that occur during plant start-up or shut-down.

Process control rooms should be visited and the parameters which are monitored and recorded should be noted. Some comparison of important design and operating parameters should be carried out.

When auditing control room procedures, the "vertical slice" approach covering what the manager says should happen, how the supervisor organises the job and what the operators actually do, may be particularly useful.

Protection systems should be assessed for suitability to each potentially hazardous fault. These should be tested regularly. The adequacy of the number of sensing points, their location, speed of response and the condition of alarm sensors should be reviewed. Records of spurious and real trips, their frequency and cause and remedial action will indicate shortcomings in alarms and protection systems.

2.3.4 Computer Controls in Process Plants An increasing number of new process plants are being equipped with process control computers which act either as monitoring devices or have full control over the process. Special knowledge is required to carry out a hazard audit of such facilities.

Judgments on the overall quality of the computer control system with respect to the hardware and system implementation and the design of the operator interface should be included in the audit. The auditor should comment on the frequency of inspection of operational settings and the adequacy of independent instrumentation provided to monitor critical parameters.

The auditor should evaluate the system's power failure response, and procedures for switchover to manual control or emergency shutdown. This review should include

6

Page 16: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

9 | Department of Planning

available documentation on the installation and testing of both hardware and software systems, historical failure rates of hardware and software, and operator training schemes. The degree of comprehension of the overall system should be confirmed by interviewing operators.

Where hardware or software is upgraded or changed, procedures should ensure that new systems perform to the latest safety requirements and that the safety at the plant is not unnecessarily compromised.

If necessary, a special audit of computer control systems, which requires specific expertise, may be recommended.

Some of the factors which should be considered in assessing computer control systems are outlined in Appendix 4.

2.3.5 Fire Safety To facilitate the review of fire safety systems, the audit team should understand the layout of fire fighting services and water supplies for fire fighting at the facility.

Fixed detection and protection systems such as sprinklers, smoke detectors, foam generators, water hydrants and water sprays/deluge systems should be assessed to ensure they are appropriate to the type and quantity of hazardous materials stored and processed on site and the location of the facility. The auditor should evaluate whether adequate and reliable water supplies and other services are available for fire fighting.

Fire safety systems should comply with the recommendations of any fire safety study previously performed. A fire safety study in accordance with the Fire Safety Study Guidelines1 may be recommended if one has not previously been performed and there are any questions about the adequacy of fire safety systems, including the supply of fire fighting water.

The auditor should comment on whether appropriate facilities for the containment and disposal of firewater which may be contaminated have been provided.

Comments on fire safety should also include an assessment of maintenance and testing programs for fire prevention equipment and other protective systems and records of these activities.

The adequacy of personnel safety systems, safety and first aid equipment, and safe work practices such as work permit systems should be assessed and, where necessary, recommendations for upgrading these made.

2.3.6 Environmental Protection Solid and liquid waste disposal and systems to control atmospheric emissions should be evaluated to ensure they are appropriate to the quantities and nature of hazardous materials handled and processed at the facility. These systems should be designed and operated to minimise the likelihood and consequences of an incident that results in release of significant quantities of chemicals which may be biologically harmful to humans or a danger to the environment.

The assessment should also cover air pollution control systems including systems to control the emission of smoke, gas, fumes and dust.

The auditor should determine if there have been any incidents resulting in the release of toxic or biologically harmful chemicals to the atmosphere or to soil or groundwater. The auditor should note approvals and licenses obtained from regulatory bodies covering the handling of hazardous materials, pollution control and related matters and whether there have been any breaches of approval or license conditions by the facility.

The auditor should comment on the adequacy of treatment of process sewage and storm water. Where appropriate, soil and groundwater monitoring systems may be

1 Hazardous Industry Planning Advisory Paper No. 2, Department of Planning.

7

Page 17: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

10 | Department of Planning

required. An assessment of measures to prevent toxic escape to groundwater systems during normal operations, and contamination following catastrophic failure, should be provided.

Arrangements for the prevention, containment, clean-up, treatment and disposal of spilled liquids or solids, contaminated rainwater and contaminated fire-fighting water should be carefully reviewed.

2.3.7 Facility Security The facility should have appropriate security systems in place to protect equipment, chemicals and processes as well as information systems. Security systems should also control legitimate and non-legitimate access to the site and should address the vulnerability of hazardous materials moving into and out of the facility.

The audit should establish that the management has identified all sources of threat and that security control measures are in place to prevent and mitigate the effects of these threats.

Attention should be given to threats coming from outside as well as inside the facility. Outside threats may include trespassing, unauthorised entry, theft, vandalism, bomb threats and terrorist acts. Inside threats may include theft by employees, substance abuse, sabotage, disgruntled employee or contractor actions and workplace violence.

The audit should ensure the adequacy of security control measures and security systems to effectively prevent all the possible threats and security scenarios.

2.4 Management Systems A review of management systems is essential to evaluate the overall safety performance of the facility. The possibility of deviation from recommended procedures is always present when the human factor is involved. Many serious incidents have occurred because of an operator's error or lack of understanding of a procedure.

The auditor should assess:

the quality and availability of plant documentation including operating procedures, maintenance program and procedures and records of inspection and testing of critical equipment and instrumentation;

materials inventory systems and records;

monitoring systems and records;

transportation records;

operator training programs;

emergency planning;

management response to recommendations arising from incidents and previous audits and studies; and

Material Safety Data Sheets (MSDSs).

Designated responsibilities during normal operations and during emergencies should be clearly understood. The extent to which contract personnel are used and their roles during normal and emergency situations should be reviewed.

It is therefore important to evaluate the scope and quality of documentation available at the site, as this will indicate management attitudes to and policies on safety, personnel selection and training. Operator logs and records of inspection, testing and maintenance of critical equipment and instrumentation provide a history of the plant's performance.

Page 18: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

11 | Department of Planning

2.4.1 Plant Procedures, Records and Other Documentation The auditor should check that operating procedures provide sufficient up-to-date information for the operator to perform tasks during normal operations, start-up, shut-down and emergencies and that, where contract personnel are used, their roles during normal and emergency situations are well defined. Where possible, these operations should be observed to check that plant procedures are being followed.

Interviews with operators will also determine whether documented operating procedures are being followed.

An evaluation of operator log books should be made, with comments on whether they are complete, up-to-date and accurate. Operator logs will also indicate whether operating parameters are different from design parameters. If frequent deviations occur, components may be suffering wear and tear, and maintenance procedures may need to be adjusted accordingly.

The auditor should determine whether an adequate documented maintenance program and procedures exist and whether operators understand these procedures sufficiently to maintain the facility in a safe and reliable state, Maintenance required on an emergency basis should be compared with scheduled maintenance. Particular attention should be paid to arrangements for setting maintenance priorities.

An evaluation of instrument calibration, inspection, testing and maintenance records should be made. Spot checks will determine if instruments are indicating correct operating conditions. The history of failure of instruments and other critical equipment should be examined.

It is important for the auditor to assess how documentation is developed, approved, used and modified and the extent to which vendors' procedures for the effective use of their equipment are being followed. The adequacy of processes for the review of plant documentation, the frequency of such reviews and the level at which changes are authorised should be considered.

An assessment of procedures for plant modifications, the revision of operating procedures following modifications and operator training should be made to ensure that the safety of the plant is not compromised by modifications.

Appendix 5 provides a list of relevant documents.

2.4.2 Operator Training An assessment of training programs will indicate if operators are trained to do their jobs and are able to meet performance criteria for their various tasks.

Documentation showing operator qualifications, training received and performance evaluation methods should be reviewed. Interviews with operators will indicate whether the company's training programs are effective.

2.4.3 Emergency Planning Emergency planning activities at the facility should be evaluated to ensure they are appropriate to the materials and processes on the site and its location. The emergency plan should be developed in accordance with the Industry Emergency Planning Guidelines.2

Emergency plans should be assessed to ensure they are clear and complete and cover action required in case of all credible incidents including fire, explosion, vessel failure, loss of utilities, bomb threats, floods, toxic leaks or spills and computer failure. The emergency plan should cover procedures for raising the alarm, communications in an emergency, procedures for shutdown of the plant, evacuation plans, emergency first aid and rescue, the control of utilities, the coordination of emergency activities with

2 Hazardous Industry Planning Advisory Paper No. 1, published by the Department of Planning.

Page 19: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

12 | Department of Planning

public and private emergency services and liaison with the NSW Police and Fire and Rescue NSW. Actions and procedures in the plan must be clear and easy to implement promptly.

While the emergency plan should deal in detail with on-site emergencies, the auditor should consider the extent of possible off-site effects that should be covered and whether actions to control and minimise off-site effects should be listed. Under some circumstances, access to adjacent properties may be required to implement the emergency plans. Where applicable, the auditor should comment on whether it is necessary to establish a procedure for notifying neighbouring facilities, the neighbouring community and the media in the event of an emergency.

Emergency plans should be in a simple format and kept up to date. As well as periodic review, review and revision may be the result of emergencies, of training exercises or of significant changes to the plant. Judgments should be made on these review procedures and how frequently reviews are done.

If located in an area where there is a concentration of hazardous industry, the auditor should comment on whether the facility should participate in the preparation of area-specific emergency plans. The site emergency plan should be compatible with:

any area emergency plan and emergency planning arrangement under the auspices of the State Emergency Management Organisation; and

with other emergency plans such as the emergency plans and operating procedures of public bodies such as the NSW Police, Fire and Rescue NSW and the NSW Ambulance Service.

The emergency plan should be assessed using simulated exercises and related activities.

An emergency plan, developed in accordance with the Department of Planning's Hazardous Industry Planning Advisory Paper No. 1, may be recommended if emergency planning at the facility is considered inadequate.

2.5 Site History

2.5.1 Incident History Minor incidents, near misses and breaches of approval conditions will indicate shortcomings in equipment or operating systems.

The history of previous emergencies (including near misses and minor incidents), how they were caused and both on-site and off-site effects, should be reviewed. Reports on these incidents should indicate whether:

emergency planning procedures and protection systems proved adequate or whether modifications were required in equipment and procedures to prevent recurrences, particularly in relation to fire, explosion, leaks and spills;

whether the facility was experiencing abnormal conditions, e.g. commissioning, start-up or shutdown;

whether the incident resulted in facility/process shutdown;

injuries or deaths sustained and off-site damage caused to property and environment.

The status of implementation of recommendations arising out of these incidents should be reviewed.

Incidents involving the transport of goods to and from the site should be examined in a similar way.

9

Page 20: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

13 | Department of Planning

2.5.2 Previous Studies Previous studies such as hazard and operability studies (HAZOPs) or hazard analyses (HAZANs), fire safety studies, hazard audits and other specialised studies such as corrosion surveys, weld surveys etc. contain important information on the facility. These investigations should have already indicated areas of the facility's operations which warrant improvement.

The proportion of the facility covered by these studies, the studies' results, the date of the last study and the status of outstanding recommendations should be noted. The auditor should determine why recommendations from previous studies have not been implemented.

While it is important that these studies be drawn on in the review it is equally important that they do not prejudice the independence and integrity of the audit. The stage in the audit process at which these studies should be reviewed is therefore a matter for careful judgment.

Page 21: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

14 | Department of Planning

3 Report Format and Content

SECTION SUMMARY

This section suggests a format for the hazard audit report and its content.

The report should be structured so as to clearly highlight the audit findings and recommendations to management and to public authorities, which may need to approve the report.

While the report does not need to include every detail of the audit, it should:

clearly identify the purpose and scope of the audit;

demonstrate that the audit team is independent, appropriately qualified and experienced;

describe the facility, its operations and hazards in sufficient detail to provide a context for the findings and recommendations;

describe the audit methodology, covering both physical systems and management systems; and

follow up the implementation of any previous study recommendations.

KEY MESSAGE

Management’s first response to the report should be an action plan specifically addressing each of the audit’s findings and recommendations.

3.1 General

3.1.1 Hazard Audit Title Page The Hazard Audit Report should have a title page, which should clearly and unambiguously identify the facility covered by the hazard audit and its location. The title sheet should also show who performed the hazard audit, who authorised the report and the date of the report.

3.1.2 Table of Contents The report should include a table of contents with page numbers. The table of contents should include a list of figures and appendices.

3.1.3 Executive Summary and Recommendations (i) Scope of report and investigations

The purpose and scope of the audit, the method used and the level of detail should be described briefly.

(ii) Summary and major findings

The summary should highlight major areas of concern arising from the audit.

(iii) Recommendations

Recommendations provided in the report should be summarised here.

3.2 Introduction and Scope of Report

3.2.1 Objectives The reason for the audit, the objectives and the specific method used should be described. The rationale for the specific audit approach adopted and the level of detail

Page 22: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

15 | Department of Planning

of the audit should be explained. The names and qualifications and experience of the auditor or audit team should also be included.

3.2.2 Summary and Conclusions The results of the audit should be discussed in this section. The auditor should be in a position to comment on the results of the debriefing session with plant management and whether plant management have a full appreciation of the hazards present at their facility and the systems being used to control these.

The main findings should be presented briefly in point form.

3.2.3 Recommendations To be of value, the audit has to result in an assessment of facility performance and a plan of action for further improvement. If applicable, the audit team may make recommendations regarding processes, practices and systems.

Detailed recommendations arising from the audit should be presented under each section heading along with their underlying rationale.

Recommendations covering the entire facility may be discussed in this section. For instance, the audit team may recommend a hazard and operability study, hazard analysis or other studies to be carried out on the facility if these have not been carried out before or if previous studies have been inadequate. In some circumstances, the audit may recommend a plant shutdown until urgent matters are attended to,

This section should provide a list of all recommendations with priorities for action. An implementation program, developed in cooperation with the company or owner or operator, should be included. If any recommendations are not to be implemented, reasons should be given.

3.3 Overview of the site

This section should present an overview of the location of the site and operations carried out.

3.3.1 Site Location, Surrounding Land Uses and Layout The report should provide a description and evaluation of the site location and layout and any inherent hazards. Maps and sketches of the facility and of surrounding land may be included.

The report should comment on any shortcomings in the facility layout, building design and construction, site security and utilities and make recommendations for improvement where appropriate.

Where detailed descriptive information has been provided in other studies, clear cross-references to these documents would suffice.

3.3.2 Process Description This should briefly summarise all the processing steps and operations being carried out, with references to documents containing more detailed information where appropriate.

3.3.3 Properties of Materials being handled/processed This section should include a listing of hazardous materials being handled, stored or processed at the facility, with an indication of variations in quantities held. The location of significant quantities of hazardous materials should be marked on a site map. Material Safety Data Sheets may be included as attachments.

11

Page 23: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

16 | Department of Planning

3.4 Hazard audit of plant operations

This section provides the results of the hazard audit of plant operations.

3.4.1 Plant and Equipment A description of process plant and equipment in use and comments on key features of design and operating parameters should be provided, with references to design specifications, drawings and other documents containing more detailed information,

The audit team should comment on the condition of buildings, process and ancillary equipment and associated protection systems. Recommendations may cover both specific items of equipment, groups of units or larger process areas.

3.4.2 Loading and Unloading Operations A description of modes of transport of goods to and from the facility should be provided along with the average and maximum quantities transported, comments on whether loading and unloading operations were observed, the adequacy of equipment, operator procedures and safety systems and recommendations for further improvement.

3.4.3 Storage The report should include an inventory of all storage and process vessels and materials being stored/processed in them.

The storage layout, condition of storage containers and associated equipment, drainage and containment systems and operator procedures should be considered for comment. Recommendations should be made where appropriate.

3.4.4 Process Control The adequacy of process control systems, emergency systems and protection systems installed should be commented on. Where they have a major role in the facility, special reference should be made to computer control systems. A special audit of computer control systems, which requires specific expertise, may be recommended.

3.4.5 Fire Safety The audit report should comment on the full range of fire safety systems at the facility. All protective systems and automatic or manually activated suppression systems should be audited.

The report should comment on the adequacy of incident recording/reporting systems at the facility and the performance of protection and emergency systems.

A fire safety study consistent with the guidelines provided in Fire Safety Study Guidelines may be recommended.

A map showing the layout of fire fighting services should be included as an attachment to the report.

3.4.6 Environmental Protection Systems Environmental protection systems to reduce or eliminate contamination of air, soil, surface water and groundwater systems should be evaluated. Additional monitoring of environmental parameters or a specialised audit of environmental systems may be recommended if appropriate.

12

Page 24: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

17 | Department of Planning

3.5 Hazard audit of management systems

3.5.1 Plant procedures, records and other documentation The scope and adequacy of documentation available at the facility should receive comment. Standard operating procedures in use - and associated documentation -should be described. Any unusual practices or aspects should be discussed. Comments on any operations that were observed during the audit should be included.

The review of procedures and documentation should include:

Materials inventory system and records

Operating procedures

Maintenance program and procedures

Instrument maintenance

Training practices

Monitoring program and records

Maintenance records

Testing records

Instrumentation calibration records

Hot work permit systems

Transport records

Material Safety Data Sheets (MSDSs)

Comments on the results of spot checks of this documentation and their accuracy should be included.

A more detailed list of information that may be reviewed is provided in Appendix 5.

Recommendations for improvement should be made where appropriate. These may cover a specific operation, recording or testing method or a broad class of procedures. Where appropriate, recommendations may also include the need to develop documentation in areas (where none was available at the time of the audit) or the need to improve the quality and availability of existing documentation.

3.5.2 Operator Training The report should comment on the adequacy of operator training and make recommendations to redress inadequacies.

3.5.3 Emergency Planning A description of the type of emergencies covered by the emergency plan should be provided along with a comment on the adequacy of coverage and recommendations for improvement. An emergency plan developed in accordance with Hazardous Industry Planning Advisory Paper No. 1 may be recommended.

3.6 Site History

3.6.1 Incident History Any incidents resulting in significant property damage or personal injury should be listed in chronological order with a brief description of causes and effects, Comments on the likelihood of these incidents recurring should be included.

Departures from relevant regulations and standards, and deviations from the development consent conditions of approval and licensing authorities' conditions, should be detailed.

Page 25: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

18 | Department of Planning

3.6.2 Previous Studies Other safety studies, including hazard audits, that have been previously carried out at the facility should be listed in chronological order. The report should comment on any outstanding recommendations.

3.7 Conclusions

The overall conclusions from the audit are presented in this section. The basis of all conclusions should be clearly stated.

In particular, the auditor should discuss factors that could result in a hazardous or catastrophic event and the likelihood and consequences of such an event, taking into account preventative and control measures at the facility.

3.8 Appendices

A list of material collected as part of the audit should be included in appendices to the report. Other appendices may be included to support findings or demonstrate the adequacy of the audit.

3.9 Glossary of abbreviations

To ensure that the audit report is understood, a glossary of special terms, titles, names of parts of the plant and a list of abbreviations should be included.

13

Page 26: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

19 | Department of Planning

Appendix 1

Materials Transfer and Process Equipment

Some of the features of material transfer and process plant that should be evaluated as part of the hazard audit are:

Equipment size and materials of construction.

Design and operating conditions

Flow rates, pressure and other physical operating conditions and how they are measured. Operating conditions should be compared to design conditions to ensure there are no significant digressions. Methods of transfer of materials from storage to processing area and between different stages of processing should be reviewed. All items of equipment should be colour coded or carry some identification of their contents.

Condition of support structures, valves, welds, flanges, gaskets and lagging.

Protection systems

Cathodic or other corrosion protection provided, leak detection systems, signs of leaks or

deterioration of seals and the performance of the containment systems. Evidence of mechanical impact, corrosion or overstressing, protection of equipment during a fire.

Conditions of valves, gaskets and other components.

The condition of components such as valves, seals, gaskets, flow transfer isolation valves and

Expansion joints. These components can release hazardous materials on failure because of fatigue or deviations from normal process conditions.

Process Instrumentation

The condition of process instrumentation, frequency of calibration and inspection.

Inspection, testing and maintenance

Frequency of inspection, testing and maintenance of process and associated safety equipment.

Relief systems on pressure vessels

All pressure vessels on site, their function and materials being handled and processed. Venting methods and other relief systems on pressure vessels should be evaluated. Records of the results of regular testing of pressure relief systems should be available.

Page 27: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

20 | Department of Planning

Appendix 2

Loading and Unloading Operations

Some of the features of loading and unloading operations that should be reviewed as part of a hazard audit are:

What materials are being loaded and unloaded

The quantities and nature of materials being loaded and unloaded, whether there is a seasonal variation (the maximum and average quantities or volumes), the mode of transportation, numbers of loaded containers, tankers or rail cars that may be parked on site.

Types of containment or packaging

Information on materials of construction for containers, drums, bags etc., types of trucks and tanks used and size, average and peak numbers of movements per day/week/year.

Loading and unloading operations

The number of filling points, safety precautions, fire protection systems and emergency planning.

Personnel employed

Number of operators and contractors employed, operator procedures and training.

Transportation by pipeline

Where materials are transported to/from the site by pipeline, the pipeline design and location (above or below ground), size, materials of construction, corrosion protection measures. Operating conditions (temperature, pressure, flow rates) should not exceed design conditions.

Ancillary Equipment

Ancillary equipment such as pumps and associated equipment and instrumentation and records for their inspection, maintenance and testing.

Transport Routes

Transport routes by various forms of transport to and from the site. Routes should be selected to minimise exposure to the community of the hazardous chemicals and materials being transported.

Page 28: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

21 | Department of Planning

Appendix 3

Storage Systems

Large amounts of hazardous chemicals and materials pose a significant hazard if not handled correctly. The hazard audit team should obtain a general description of storage systems and evaluate relevant factors including:

The nature and quantity of material stored

The materials stored in storage vessels, drums or other containers, average and maximum number of containers filled per day and the number of filled and empty containers stored on site.

Comparison of design and storage conditions

Design storage conditions (pressure, temperature, state of the materials etc.), materials of construction, size of the vessel/storage container, type of venting and relief systems, other design parameters and spacing. These should be compared to actual storage conditions.

Material stored in warehouses

Details of materials stored in warehouses in drums or other packaging and the storage configuration, e.g. stacking height, aisle spacing and fixed protection provided should be obtained. In the storage area, the height of stacks should not exceed levels appropriate to the design and the capability of fixed fire protection systems and sufficient sprinkler clearance should be available. Bins, racks, pallets and drums should be in good condition.

Inventories held

Average and maximum inventories for each vessel/ storage container. The auditor should note whether vessels and storage areas are suitably identified, indicating contents and hazards. Piping to and from storage vessels should be colour coded to identify contents.

Siting of storage vessels and storage areas

Appropriate siting relative to other storage and process areas and to the site boundary such that storage areas are protected from exposure to damage, interference or excessive heat. Separation distances between vessels should be appropriate to the type and quantity of material being stored.

Drainage and containment

Drainage and containment systems (bunds and compounds). These should minimise the possibility of contamination of or mixing with potentially unstable materials. The ways in which the hazardous material might escape from containment and precautions taken to limit the potential consequences should be considered. Separators and processes for the treatment of contaminated run-off should be provided where required.

Support structures

The mechanical integrity of support structures. They should be maintained in good condition and free from corrosion. The condition of rivets and welds should be noted. Adequate access for inspection should be available. The results of regular tests for internal corrosion should be available.

Fire Safety

Page 29: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

22 | Department of Planning

Fixed protection systems and access for fire fighting. The audit team should also note emergency shutoff systems, remote and local isolation points, static earthing and use of flame proof electrical equipment where flammable liquids are being handled.

Filling procedures

The filling method, number and location of filling points, type of meters used, frequency of calibration and whether different materials are filled at the same point. The location of filling points should be suitable to the class of the material being handled. Storage vessels should have a marked filling point and be fitted with overfill protection where appropriate. Liquid tight connections should be provided for filling tanks. Leak testing should be carried out on a regular basis.

Operators used

Number of operators involved, their supervision and training.

Venting and pressure relief

Safety systems such as venting and relief systems, level gauges and other instrumentation, number and type of relief, isolation, sampling and drain valves and earthing protection. Safety and protection systems should be in good working order.

Disposal of empty containers

Disposal procedures for scrap storage containers and standards of tidiness around storage areas.

Page 30: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

23 | Department of Planning

Appendix 4

Computer Controls in Process Plants

Specialised techniques are required in carrying out a hazard audit of computerised process control systems.

Computerised process control systems are subject to two major types of failures:

hardware failures, which are a function of hardware reliability;

systematic failures which always occur under the same conditions as a result of errors or omissions in the safety requirements specification or errors in the design, manufacture, installation and operation of hardware and software.

If the computer control system has been subjected to a full HAZOP prior to commissioning, it should be designed and installed in accordance with the recommendations of the HAZOP. A full HAZOP may be recommended if one has not been performed.

The computer control system should incorporate both hardware and software safety related systems. The auditor should comment on the overall quality of the hardware implementation and the design of the operator interface.

Hardware safety systems may include redundancy, power supply monitors and so on. Independent instrumentation should be provided to monitor critical parameters. There should be provision for inspection of operational settings. Software safety systems may include systems to detect memory corruption, watchdog programs and so on.

The system's power failure response and procedures for switchover to manual control or emergency shutdown should be reviewed. Documentation on historical failures of hardware and software should be available. Faults within computer hardware and software should not cause a dangerous mode of failure. In case of failure, the system should provide sufficient information for safe manual control. In the event of a power failure, the plant must revert to a safe condition. This safe condition must be maintained on restoration of power. The auditor should make at least a qualitative evaluation of the effectiveness of these systems.

Documentation on the installation and testing of both hardware and software systems should be reviewed. Special operator manuals are usually required for computerised control systems. These manuals should define operator and system interactions for every operating state. This means the operator's control option and the system response to both correct and incorrect selection options should be included.

The auditor should evaluate operator training schemes and determine the degree of comprehension of the overall system.

Documented procedures should be provided for all hardware and software changes including procedures for testing changes prior to implementation and authorisation of changes. Strict controls should also apply to access program source code and the use of various software versions. Where hardware is upgraded or changed, procedures should be followed to ensure that new hardware performs at a level which meets past standards.

Page 31: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

24 | Department of Planning

Appendix 5

List of Documented Information that may be Reviewed for Audit

As outlined in Section 2, review and assessment of relevant documentation is an important component of the audit.

The auditor should comment on the quality and availability of the various types of documentation and make recommendations for improvement where appropriate.

It is not necessary to attach copies of all documents reviewed during the audit. Where substantial information has been derived from a specific document, an appropriate reference should be cited.

Information, preferably documented, that should be obtained and reviewed as part of the hazard audit includes:

A: Information on the location of the facility and its layout

Layout maps

Location map, including surrounding area

Location of significant quantities of hazardous materials

B: Process Description

Process chemistry

Process parameters

Process flow diagrams

Feed and product specifications

Process design conditions

C: Hazardous Chemicals stored, processed or transported

Physical and chemical properties

Material Safety Data Sheets ((MSDSs)

Inventory records of all raw materials, intermediates and products (average, maximum and minimum)

D: Process Design

Piping and Instrumentation Diagrams (P&IDs)

Equipment specifications for specific equipment and process units.

E: Process Operating Conditions

Monitoring program

Monitoring records of critical safety parameters Operator logs

F: Operating procedures:

Startup procedures

Shut down procedures

Emptying and cleaning procedures Draining procedures

Effluent disposal

Page 32: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

25 | Department of Planning

Loading and unloading procedures Material transfer procedures within the plant Valve by valve procedures for all operating tasks Schematic drawings for operators

Safety instructions and precautions for operators Information on equipment and systems for operators

Procedures for updating documentation

Procedures for modifying documentation

G: Maintenance Program:

Maintenance procedures manual

Equipment inspection and maintenance records

Records of instrument testing

Work order systems

Maintenance planning and scheduling systems

Preventative maintenance programs

Equipment history records

Spare parts inventory system

Training for maintenance personnel

Inspection and testing records for critical equipment or components subject to fatigue

Records of tank and vessel testing

H: Instrument Maintenance Procedures:

Frequency of calibration

Records on the inspection of sensors

Records on the checking of alarms and interlocks

Records of trips including spurious trips

I: Emergency Planning and Procedures:

Emergency plan

Records of emergency planning/training

Emergency call out procedures

Fire safety hardware specifications

Fire water systems piping diagram

information on safety systems and equipment

Instructions for use during emergencies

Inspection and testing of emergency response-related equipment leg. alarms, communication equipment etc.)

Incident and near-incident recording procedures and records (including adequacy of response)

J: Operator Training

Job classification for operators

Description of operator training programs

Operator qualifications

Operator turnover

Operator overtime records

Page 33: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

26 | Department of Planning

K: Safety Systems and Practice:

Safety policy and procedures manual

Records of testing of safety equipment

List of alarms

List of interlocks

List of pressure relief systems and testing of these

Records of safety meetings/training

Records of other safety requirements (permits to work, modifications control)

Personnel protection systems and records of their use

Reporting procedures for unusual incidents

L: Site History

Records of unusual incidents

Reports of past accident investigations, hazard audits and safety reviews

Other safety studies performed for the facility

M: Codes and Standards Relevant to the Facility

N: Transportation

Records of materials movements in and out by mode of transport including pipelines

Page 34: Hazard Audit Guidelines - planning.nsw.gov.au

HIPAP 5: Hazard Audit Guidelines | January 2011

27 | Department of Planning

Additional Information

Relevant DoP Publications

Hazardous Industry Planning Advisory Papers (HIPAPs):

No. 1 - Emergency Planning

No. 2 - Fire Safety Study Guidelines

No. 3 - Risk Assessment

No. 4 - Risk Criteria for Land Use Safety Planning

No. 5 - Hazard Audit Guidelines

No. 6 - Hazard Analysis

No. 7 - Construction Safety

No. 8 - HAZOP Guidelines

No. 9 - Safety Management

No. 10 - Land Use Safety Planning

No. 11 - Route Selection

No. 12 - Hazards-Related Conditions of Consent

Other Publications:

Applying SEPP 33: Hazardous and Offensive Development Application Guidelines

Multi-level Risk Assessment

Locational Guideline: Liquefied Petroleum Gas Automotive Retail Outlets

Locational Guideline: Development in the Vicinity of Operating Coal Seam Methane Wells

Electronic copies of some of these publications are available at: www.planning.nsw.gov.au